CN114598520A - Method, apparatus, device and storage medium for resource access control - Google Patents

Abstract

Embodiments of the present application provide a method, apparatus, device, and storage medium for resource access control, which belong to the technical field of computers. This method compiles the custom rule language and runs it on the rule server, so that the rule server can analyze whether the user has access rights when the user accesses resources, which can prevent the user from simply and directly accessing the user resources that have the same rights as him. An attacker can be prevented from trying to access the resources of a user who has the same permissions as him, thereby improving the security of the system. In addition, the access control mechanism provided by this application will define different roles according to the needs of the task when the user accesses for the first time, assign resources and operation rights to different roles, and dynamically change the user's rights when the user accesses illegal resources for more than a certain number of times. When the user has repeatedly tried to access illegal resources, reduce the user's authority to improve the security of the system.

Description

Method, apparatus, device and storage medium for resource access control

technical field

The present application relates to the field of computer technologies, and in particular, to a method, apparatus, device, and storage medium for resource access control.

Background technique

In order to improve the security of data resources, it is necessary to perform access control on resources. Access control is implemented at the data, application, system, network and permission levels. For important financial institutions such as banks and securities, access control is the focus of information security.

Generally speaking, the main types of access control can include three: discretionary access control, mandatory access control and role-based access control. Among them, role access control is widely used because it can effectively avoid vertical unauthorized access (vertical unauthorized access refers to a low-level attacker trying to access resources of high-level users). Role-based access control is the control of access to roles. Roles are a collection of certain permissions, and users get the permissions of their roles by becoming members of appropriate roles.

However, role-based access control mechanisms cannot prevent lateral override, which is when an attacker tries to access the resources of a user who has the same permissions as him. For example, both user a and user b can view the order, but user a can access b's order after improperly obtaining the Uniform Resource Locator (URL) of user b's viewing order. Therefore, if horizontal overreach occurs in transaction links such as payment, it will cause immeasurable losses and impacts.

SUMMARY OF THE INVENTION

The present application provides a method, device, device and storage medium for resource access control. In the process of user access to data resources, according to the rule language model, according to the user's behavior field, permission field, historical access information, etc. The access result is analyzed, so as to obtain whether the user is allowed to perform the resource access result process, which can ensure that the problem of illegal user access to data resources can be avoided.

In a first aspect, a method for resource access control is provided, wherein the method includes:

receiving an access request sent by a user terminal, where the access request is used to request access to a data resource, and the access request includes a user identification ID corresponding to the access user;

Performing rule language conversion on the access request to obtain an access request in a target rule language, where the target rule language is different from the original rule language corresponding to the access request, and the target rule language is consistent with the language rule corresponding to the data resource;

According to the user ID, query whether there is historical access information corresponding to the user ID from the rule database, and obtain the query result, where the historical access information is the target rule language, and the target rule language is the original language corresponding to the access request. different;

When the query result indicates that there is no historical access information corresponding to the user ID in the rule database, assign a first access right to the access user according to the user ID; when the query result indicates that the rule database exists When the historical access data corresponding to the user ID is used, the second access authority of the accessing user is obtained from the rule database according to the user ID, wherein the first access authority is the authority corresponding to the user's first access, and the The second access authority is the authority corresponding to the user's non-first access;

Obtain a behavior field according to the access request, and input the behavior field, the first access authority or the second access authority, and the number of illegal accesses into the rule server, where the behavior field is used to indicate the access behavior of the accessing user , and the behavior fields, access rights and number of illegal accesses are all target rule languages;

An access analysis result output by the rule server is acquired, where the access analysis result is used to indicate whether the access user is allowed to access data.

The method for resource access control provided by the embodiments of the present application may have the following beneficial technical effects: 1. Prevent users with the same role from viewing data resources laterally without authority. Specifically, the resource access control method based on the rule language provided by this proposal can judge the legitimacy of user access to resources by setting a custom rule language, compiling the rule language and running it on the rule server, preventing users from accessing resources. Simply and directly access user resources with the same authority, so that in the process of accessing resources, the problem of easy access and tampering of other user resources by attackers can be avoided, and the security of the system and data resources can be improved. 2. In the resource access control method based on the rule language provided by the embodiment of the present application, when a user accesses a data resource for the first time, the server can assign different resource access rights or resource operation rights to different roles. The number of illegal accesses by the user, dynamically change the user's authority, and reduce the user's authority when the user attempts to access illegal resources for many times, thereby improving the security of the resource.

With reference to the first aspect, in some implementations of the first aspect, the historical access data includes at least one of the following:

The first access authority or the second access authority corresponding to the user ID, the number of illegal visits and the number of legal visits in the historical access corresponding to the user ID.

In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

When it is determined that the user accesses the data resource for the first time, user information corresponding to the user is obtained according to the access request, where the user information includes the user ID and the first permission assigned to the accessing user;

Store the acquired user information in the rule database.

With reference to the first aspect, in some implementations of the first aspect, the conversion of a rule language to the access request to obtain the access request of the target rule language specifically includes:

The access request is converted from the original rule language to the target rule language through the RE file in the rule server, where the original rule language is the rule language corresponding to the access request input.

With reference to the first aspect, in some implementations of the first aspect, before performing rule language conversion on the access request, the method further includes:

The RE file is generated, and the RE file is used to indicate the rules converted into the target rule language.

In conjunction with the first aspect, in some implementations of the first aspect, the generating the RE file specifically includes:

performing a first analysis process on a first language, where the first analysis process includes removing comments and/or lexical analysis, and the first language is a custom language;

Using the target rule language to convert the processed first language into an intermediate language, where the intermediate language is a language obtained by performing the target rule language conversion on the first language;

compiling the intermediate language into corresponding code;

The RE file is generated according to the code.

The resource access method provided by the embodiment of the present application, by compiling the custom rule language and running it on the rule server, enables the rule server to analyze whether the user has access rights when the user accesses the resource, which can prevent the user from simply and directly accessing and He has user resources with the same permissions, which can prevent attackers from trying to access the resources of users who have the same permissions as him, so as to improve the security of the system. In addition, the access control mechanism provided by this application will define different roles according to the needs of the task when the user accesses for the first time, assign resources and operation rights to different roles, and dynamically change the user's rights when the user accesses illegal resources for more than a certain number of times. When the user has repeatedly tried to access illegal resources, reduce the user's authority to improve the security of the system.

In a second aspect, an apparatus for resource access control is provided, including:

a receiving module, configured to receive an access request sent by a user terminal, where the access request is used to request access to a data resource, and the access request includes a user identification ID corresponding to the access user;

The conversion module is used to perform rule language conversion on the access request, and obtain the access request of the target rule language, the target rule language is different from the original rule language corresponding to the access request, and the target rule language corresponds to the data resource consistent with the language rules;

The processing module is used to query whether there is historical access information corresponding to the user ID from the rule database according to the user ID, and obtain a query result, where the historical access information is the target rule language, and the target rule language and access The original language corresponding to the request is different; when the query result indicates that there is no historical access information corresponding to the user ID in the rule database, assign a first access right to the access user according to the user ID; when the query When the result indicates that there is historical access data corresponding to the user ID in the rule database, the second access authority of the accessing user is obtained from the rule database according to the user ID, wherein the first access authority is the first access authority of the user. The permission corresponding to the access, and the second access permission is the permission corresponding to the user's non-first access; obtain the behavior field according to the access request, and assign the behavior field, the first access permission or the second access Permissions, and the number of illegal accesses are entered into the rule server, the behavior field is used to indicate the access behavior of the accessing user, and the behavior field, the access authority and the number of illegal accesses are all target rule languages; the access analysis output by the rule server is obtained As a result, the access analysis result is used to indicate whether the access user is allowed to access the data.

With reference to the second aspect, in some implementations of the second aspect, the processing module is further configured to acquire user information corresponding to the user according to the access request when it is determined that the user accesses the data resource for the first time, The user information includes the user ID and the first authority assigned to the access user;

Store the acquired user information in the rule database.

With reference to the second aspect, in some implementations of the second aspect, the conversion module is further configured to convert the access request from the original rule language to the target rule language through the RE file in the rule server , the original rule language is the corresponding rule language when the access request is input.

With reference to the second aspect, in some implementations of the second aspect, the processing module is further configured to:

Before performing rule language conversion on the access request, the RE file is generated, where the RE file is used to indicate the rules converted into the target rule language.

With reference to the second aspect, in some implementations of the second aspect, the processing module is specifically configured to:

performing a first analysis process on a first language, where the first analysis process includes removing comments and/or lexical analysis, and the first language is a custom language;

Using the target rule language to convert the processed first language into an intermediate language, where the intermediate language is a language obtained by performing the target rule language conversion on the first language;

compiling the intermediate language into corresponding code;

The RE file is generated according to the code.

In a third aspect, a device for automatically extracting log data is provided, including:

one or more processors;

one or more memories;

The one or more memories include computer program instructions that, when executed in the processor, cause the apparatus to perform the following steps:

receiving an access request sent by a user terminal, where the access request is used to request access to a data resource, and the access request includes a user identification ID corresponding to the access user;

Performing rule language conversion on the access request to obtain an access request in a target rule language, where the target rule language is different from the original rule language corresponding to the access request, and the target rule language is consistent with the language rule corresponding to the data resource;

According to the user ID, query whether there is historical access information corresponding to the user ID from the rule database, and obtain the query result, where the historical access information is the target rule language, and the target rule language is the original language corresponding to the access request. different;

When the query result indicates that there is no historical access information corresponding to the user ID in the rule database, assign a first access right to the access user according to the user ID; when the query result indicates that the rule database exists When the historical access data corresponding to the user ID is used, the second access authority of the accessing user is obtained from the rule database according to the user ID, wherein the first access authority is the authority corresponding to the user's first access, and the The second access authority is the authority corresponding to the user's non-first access;

Obtain a behavior field according to the access request, and input the behavior field, the first access authority or the second access authority, and the number of illegal accesses into the rule server, where the behavior field is used to indicate the access behavior of the accessing user , and the behavior fields, access rights and number of illegal accesses are all target rule languages;

An access analysis result output by the rule server is acquired, where the access analysis result is used to indicate whether the access user is allowed to access data.

In conjunction with the third aspect, in some implementations of the third aspect, the computer program instructions, when executed in the processor, cause the apparatus to implement the following steps:

When it is determined that the user accesses the data resource for the first time, user information corresponding to the user is obtained according to the access request, where the user information includes the user ID and the first permission assigned to the accessing user;

Store the acquired user information in the rule database.

In conjunction with the third aspect, in some implementations of the third aspect, the computer program instructions, when executed in the processor, cause the apparatus to implement the following steps:

The access request is converted from the original rule language to the target rule language through the RE file in the rule server, where the original rule language is the rule language corresponding to the access request input.

In conjunction with the third aspect, in some implementations of the third aspect, the computer program instructions, when executed in the processor, cause the apparatus to implement the following steps:

Before performing rule language conversion on the access request, the RE file is generated, where the RE file is used to indicate the rules converted into the target rule language.

In conjunction with the third aspect, in some implementations of the third aspect, the computer program instructions, when executed in the processor, cause the apparatus to implement the following steps:

performing a first analysis process on a first language, where the first analysis process includes removing comments and/or lexical analysis, and the first language is a custom language;

Using the target rule language to convert the processed first language into an intermediate language, where the intermediate language is a language obtained by performing the target rule language conversion on the first language;

compiling the intermediate language into corresponding code;

The RE file is generated according to the code.

In a fourth aspect, a computer-readable storage medium is provided, the computer-readable storage medium stores a computer-executable program, and when the computer-executable program is invoked by a computer, the computer can implement the above-mentioned first aspect The method described in any one of the implementations.

In a fifth aspect, a computer program product is provided, the computer program product includes computer program instructions, and when the computer program instructions are executed on a computer, the computer or processor is made to implement any one of the above-mentioned implementation manners in the first aspect method described in.

In a sixth aspect, a chip system is provided, wherein the chip system includes computer-readable program instructions, which, when the computer-readable program instructions are executed on a computer, cause the computer to execute any implementation of the first aspect method described in the method.

Description of drawings

FIG. 1 is a schematic diagram of a system architecture to which a method for controlling access to resources provided by an embodiment of the present application is applicable.

FIG. 2 is a schematic flowchart of a method for resource control access provided by an embodiment of the present application.

FIG. 3 is a schematic structural diagram of an apparatus for controlling access to resources provided by an embodiment of the present application.

FIG. 4 is a schematic structural diagram of a device for controlling access to resources provided by an embodiment of the present application.

Detailed ways

It should be noted that the terms used in the implementation part of the embodiments of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application. In the description of the embodiments of the present application, unless otherwise specified, "/" means or means, for example, A/B can mean A or B; "and/or" in this document is only an association that describes an associated object Relation, it means that there can be three kinds of relations, for example, A and/or B can mean that A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, unless otherwise specified, "a plurality" refers to two or more than two, and "at least one" and "one or more" refer to one, two or two above.

Hereinafter, the terms "first" and "second" are only used for descriptive purposes, and should not be construed as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, a reference to a "first", "second" feature may expressly or implicitly include one or more of that feature.

References in this specification to "one embodiment" or "some embodiments" and the like mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases "in one embodiment," "in one implementation," "in some other embodiments," "in other embodiments," etc. in various places in this specification are not All necessarily refer to the same embodiments, but rather mean "one or more but not all embodiments" unless specifically emphasized otherwise. The terms "including", "including", "having" and their variants mean "including but not limited to" unless specifically emphasized otherwise.

In combination with the introduction of the background art, the existing role-based access control mechanism cannot prevent horizontal overreach, easily causes users with the same authority to illegally view data of other users, and cannot guarantee user data security.

In order to solve the above problems, the embodiment of the present application provides a method for access control based on a rule language. Analyze and obtain whether users are allowed to access data, so as to solve the problem of illegal access of other users' data by users with the same authority, and improve the security of data resources.

It should be noted that the rule language-based access control method provided by the embodiment of the present application can be applied to a data management server, such as a cloud server, a background server, and the like, and the specific type of the server is not limited in the embodiment of the present application.

Exemplarily, as shown in FIG. 1 , a schematic diagram of a system architecture to which a method for access control based on a rule language provided by an embodiment of the present application is applied.

Specifically, the system architecture may include a user terminal 101 , a data management server 102 , a rule server 103 and a rule database 104 . The rule server 103 and the rule database 104 may be included in the data management server 102. In this case, the rule server 103 may be specifically implemented as a processing unit in the data management server 102 that executes the rule language model; or, the rule server 103 and the rule database 104 may correspond to other devices than the data management server 102 . This embodiment of the present application does not limit this.

In some embodiments, the data management server 102 may be used to manage various types of data resources, for example, the data management server 102 may be used to manage data corresponding to different users, and the data corresponding to different users may include, for example, personal information of users (such as the user's address information, mobile phone number information, etc.), user identification (such as user name, ID number, etc.), etc.; for example, the data management server 102 may also be used to manage business data, and the business data may include, for example, financial Business data, insurance business data, etc., the specific types of the business data are not limited in this embodiment of the present application.

In addition, the data management server 102 can also be used to interact with the user terminal. For example, the data management server 102 can receive data access requests sent by the user terminal through wireless network communication; for example, the data management server 102 can also communicate through wireless network. technology to send a data access indication message to the user terminal, the data access indication message is used to inform whether the user is allowed to access the data; for another example, when the user is allowed to access the data, the data management server 102 can also use wireless communication technology Data and the like requested by the user are sent to the user terminal.

It should be noted that, the data management server 102 and the user terminal 101 can interact based on any existing wireless communication protocol, such as long term evolution (LTE) wireless network, fifth generation mobile communication technology (the 5th generation, 5G) ), etc., which are not limited in the embodiments of the present application.

In some embodiments, the rules server 103 may run a rules language. Specifically, the rule server 103 may support a language compiled by running a rule compiler, wherein the rule language may be a language obtained by compiling a custom language by a compiler.

The custom language here can be the language set by the data resource administrator using any existing language rules; or, the custom language can also be set by the user, for example, the user can access the resource through the configuration page Select a pre-set available language. This embodiment of the present application does not limit the specific type of the custom language.

In some embodiments, the rule database 104 may store data resources for users, for example, may store data corresponding to different users, and the data corresponding to different users may include, for example, personal information of users (such as user address information, mobile phone number information, etc.), User identification (such as user name, ID number, etc.), etc.; for another example, the rule database 103 may also be used to store business data, and the business data may include, for example, financial business data, insurance business data, etc. The specific type of business data is not limited.

Exemplarily, as shown in FIG. 2 , it is a schematic flowchart of a method for resource access control based on a rule language provided by an embodiment of the present application. The method may be executed by a server or a terminal. Specifically, the corresponding process may include the following steps:

S201: Receive an access request sent by a user terminal, where the access request is used to request access to a data resource, and the access request includes a user identification ID corresponding to the accessing user.

S202, performing rule language conversion on the access request to obtain an access request in a target rule language, where the target rule language is different from the original language corresponding to the access request, and the target rule language and the language rule corresponding to the data resource Consistent.

In some embodiments, performing rule language conversion on the access request to obtain the access request in the target rule language specifically includes: converting the access request from the original rule language into a RE file in the rule server. The target rule language and the original rule language are the corresponding rule language when the access request is input.

Wherein, the target rule language can be obtained based on the RE file, and the generation process can refer to the description in step S206 for details.

S203 , query whether there is historical access information corresponding to the user ID from a rule database according to the user ID, and obtain a query result, where the historical access information is the target rule language.

S204, when the query result indicates that the rule database does not have historical access information corresponding to the user ID, assign a first access right to the access user according to the user ID; when the query result indicates that the rule When the historical access data corresponding to the user ID exists in the database, the second access authority of the visiting user is obtained from the rule database according to the user ID, wherein the first access authority is the authority corresponding to the user's first access , the second access authority is the authority corresponding to the user's non-first access.

The historical access data may include, for example, the access authority corresponding to the user ID, the number of illegal accesses and the number of legal accesses in the historical access corresponding to the user ID, and the like.

In some embodiments, when the historical access data corresponding to the user ID is not queried in the rule database, it means that the accessing user is accessing the server for the first time. At this time, the data management server can assign the first access authority to the user according to the user ID. . It should be understood that different user IDs may correspond to different user roles, and different user roles may have different access rights. Therefore, the data management server may assign a first access right to the user according to the user ID.

In some embodiments, when it is determined that the accessing user accesses the data for the first time, the data management server may store the acquired user information (eg, user ID, first authority assigned to the accessing user, etc.) to the rule database. Optionally, the data management server can also store the subsequent access behavior, access results (including normal access, illegal access), etc. of the access user in the rule database, so that when the access user accesses again later, it can be analyzed based on these historical data. Allow user access.

In some embodiments, when the historical access data corresponding to the user ID is queried in the rule database, it indicates that the accessing user is not accessing the server for the first time. In this case, in addition to storing historical access data corresponding to the user ID, the rule database may also store user information (such as user roles, access rights, etc.) corresponding to the user ID. At this time, the data management server may obtain the second access authority corresponding to the access user from the rule database according to the user ID.

S205: Acquire a behavior field according to the access request, and input the behavior field, the first access authority or the second access authority, the access authority and the number of illegal accesses into the rule server, where the behavior field is used to indicate the access of the access user behavior, and the behavior fields, access rights and number of illegal accesses are all target rule languages.

In some embodiments, the data management server may obtain the behavior field by extracting the behavior field from the access request.

S206: Acquire an access analysis result output by the rule server, where the access analysis result is used to indicate whether the access user is allowed to access data.

For step 205, in this solution, the behavior field, possession authority and the number of illegal access requests jointly determine whether the user's access behavior exceeds the authority through the rules recorded in the rule server. The RE file is loaded in the rule server of this solution, and the RE file is used to indicate the rules converted into the target rule language. Exemplarily, the RE file is generated by the following steps:

S301. Perform a first analysis process on a first language, where the first analysis process includes removing comments and/or lexical analysis, and the first language is a custom language.

S302 , using the target rule language to convert the processed first language into an intermediate language, where the intermediate language is a language obtained by performing the target rule language conversion on the first language.

S303: Compile the intermediate language into corresponding codes.

S304. Generate the RE file according to the code.

Specifically, taking the R language as the first language as an example, the generation process of the RE file may include: (1) the R compiler (a rule compiler) converts the R language (a rule language) through the RP processor ( A rule processor) removes comments, performs lexical analysis, etc., where R language is a custom language; (2) uses RA rule language generator to generate intermediate language: RA language, RA language can be generated not only by R language, but also by other Language generation; (3) use the R compiler to generate the RO code from the RA language; (4) use the RL rule language linker to link to generate the RE file.

It should be noted that this step conforms to the general principle of compilers, and compilation is a program that translates "one language" into "another language". This step is to translate R language (a custom rule language) into the corresponding RO code.

It should also be noted that the rule server in this solution is an environment that can run the rule language, and the rule compiler is a program that produces the rule language through syntax analysis, semantic analysis, etc. that can be run on the rule server; the rule compiler compiles multiple times. The result is the same, with generalized idempotency, and the result of the rule server is determined by the program, not by humans.

For example, user A and user B have the same authority to access resources with the same attributes, but user A has tried to access illegal resources for many times. After the rule server determines that user A's authority has been downgraded, user A cannot access the resource; but user B cannot access the resource. can access the resource. When a user accesses, the permission field can be obtained from the background server as Read_File, and the resource accessed by the user is a file; the user's permission field and the resources accessed by the user are represented by the rule language, which is compiled by the rule compiler and output on the rule server. decision result. Since the user permission is Read_File, the rule program decides that the user can perform operations no higher than read on the resource file.

According to the resource access control method based on the rule language provided by the embodiment of the present application, by compiling the custom rule language and running it on the rule server, the rule server can analyze whether the user has access rights when the user accesses resources, which can prevent the user from Simple and direct access to user resources with the same permissions as him can prevent attackers from trying to access the resources of users with the same permissions as him, so as to improve the security of the system. In addition, the access control mechanism provided by this application will define different roles according to the needs of the task when the user accesses for the first time, assign resources and operation rights to different roles, and dynamically change the user's rights when the user accesses illegal resources for more than a certain number of times. When the user has repeatedly tried to access illegal resources, reduce the user's authority to improve the security of the system.

Exemplarily, as shown in FIG. 3 , it is a schematic structural diagram of an apparatus for resource control access provided by an embodiment of the present application. The apparatus 300 for controlling access to resources includes a receiving module 301 , a converting module 302 and a processing module 303 .

In some embodiments, the receiving module 301 may be configured to receive an access request sent by a user terminal, where the access request is used to request access to a data resource, and the access request includes a user identification ID corresponding to the access user;

The conversion module 302 can be used to perform rule language conversion on the access request, and obtain the access request of the target rule language, where the target rule language is different from the original rule language corresponding to the access request, and the target rule language is different from the data The language rules corresponding to the resources are consistent;

The processing module 303 can be used to query whether there is historical access information corresponding to the user ID from the rule database according to the user ID, and obtain a query result, where the historical access information is the target rule language, and the target rule language It is different from the original language corresponding to the access request; when the query result indicates that the rule database does not have historical access information corresponding to the user ID, the access user is assigned a first access right according to the user ID; When the query result indicates that the rule database has historical access data corresponding to the user ID, the second access authority of the visiting user is obtained from the rule database according to the user ID, wherein the first access authority is The authority corresponding to the user's first visit, and the second access authority is the authority corresponding to the user's non-first visit; the behavior field is obtained according to the access request, and the behavior field, the access authority and the number of illegal visits are entered into the rule server, The behavior field is used to indicate the access behavior of the access user, and the behavior field, the access authority and the number of illegal accesses are all target rule languages; the access analysis result output by the rule server is obtained, and the access analysis result is used to indicate Whether to allow the access user to access data.

In some embodiments, the processing module 303 may be further configured to acquire user information corresponding to the user according to the access request when it is determined that the user accesses the data resource for the first time, where the user information includes the user ID, the first permission assigned to the access user;

Store the acquired user information in the rule database.

In some embodiments, the conversion module 302 may be further configured to convert the access request from the original rule language to the target rule language through the RE file in the rule server, where the original rule language is all The corresponding rule language when the access request is input.

In some embodiments, the processing module 303 can also be used to:

Before performing rule language conversion on the access request, the RE file is generated, where the RE file is used to indicate the rules converted into the target rule language.

In some embodiments, the processing module 303 can be specifically used for:

performing a first analysis process on a first language, where the first analysis process includes removing comments and/or lexical analysis, and the first language is a custom language;

Using the target rule language to convert the processed first language into an intermediate language, where the intermediate language is a language obtained by performing the target rule language conversion on the first language;

compiling the intermediate language into corresponding code;

The RE file is generated according to the code.

Exemplarily, as shown in FIG. 4 , it is a schematic structural diagram of a device for controlling access to resources provided by an embodiment of the present application. The resource control access device 400 may include one or more processors 401 and one or more memories 402, wherein the memory 402 stores computer readable program instructions. The at least one processor 401 and the at least one memory 402 may be communicatively connected through a universal serial bus 403 .

In some embodiments, the computer program instructions, when executed in the processor, cause the apparatus to perform the following steps:

receiving an access request sent by a user terminal, where the access request is used to request access to a data resource, and the access request includes a user identification ID corresponding to the access user;

Performing rule language conversion on the access request to obtain an access request in a target rule language, where the target rule language is different from the original rule language corresponding to the access request, and the target rule language is consistent with the language rule corresponding to the data resource;

According to the user ID, query whether there is historical access information corresponding to the user ID from the rule database, and obtain the query result, where the historical access information is the target rule language, and the target rule language is the original language corresponding to the access request. different;

When the query result indicates that there is no historical access information corresponding to the user ID in the rule database, assign a first access right to the access user according to the user ID; when the query result indicates that the rule database exists When the historical access data corresponding to the user ID is used, the second access authority of the accessing user is obtained from the rule database according to the user ID, wherein the first access authority is the authority corresponding to the user's first access, and the The second access authority is the authority corresponding to the user's non-first access;

Obtain a behavior field according to the access request, and input the behavior field, the first access authority or the second access authority, and the number of illegal accesses into the rule server, where the behavior field is used to indicate the access behavior of the accessing user , and the behavior fields, access rights and number of illegal accesses are all target rule languages;

An access analysis result output by the rule server is acquired, where the access analysis result is used to indicate whether the access user is allowed to access data.

In some embodiments, the computer program instructions, when executed in the processor, cause the apparatus to perform the following steps:

When it is determined that the user accesses the data resource for the first time, user information corresponding to the user is obtained according to the access request, where the user information includes the user ID and the first permission assigned to the accessing user;

Store the acquired user information in the rule database.

In some embodiments, the computer program instructions, when executed in the processor, cause the apparatus to perform the following steps:

The access request is converted from the original rule language to the target rule language through the RE file in the rule server, where the original rule language is the rule language corresponding to the access request input.

In conjunction with the third aspect, in some implementations of the third aspect, the computer program instructions, when executed in the processor, cause the apparatus to implement the following steps:

Before performing rule language conversion on the access request, the RE file is generated, where the RE file is used to indicate the rules converted into the target rule language.

In some embodiments, the computer program instructions, when executed in the processor, cause the apparatus to perform the following steps:

performing a first analysis process on a first language, where the first analysis process includes removing comments and/or lexical analysis, and the first language is a custom language;

Using the target rule language to convert the processed first language into an intermediate language, where the intermediate language is a language obtained by performing the target rule language conversion on the first language;

compiling the intermediate language into corresponding code;

The RE file is generated according to the code.

The method for resource access control provided by the embodiments of the present application may have the following beneficial technical effects: 1. Prevent users with the same role from viewing data resources laterally without authority. Specifically, the resource access control method based on the rule language provided by this proposal can judge the legitimacy of user access to resources by setting a custom rule language, compiling the rule language and running it on the rule server, preventing users from accessing resources. Simply and directly access user resources with the same authority, so that in the process of accessing resources, the problem of easy access and tampering of other user resources by attackers can be avoided, and the security of the system and data resources can be improved. 2. In the resource access control method based on the rule language provided by the embodiment of the present application, when a user accesses a data resource for the first time, the server can assign different resource access rights or resource operation rights to different roles. The number of illegal accesses by the user, dynamically change the user's authority, and reduce the user's authority when the user attempts to access illegal resources for many times, thereby improving the security of the resource.

Based on the same technical concept, the embodiments of the present application also provide a computer-readable storage medium, where the computer-readable storage medium stores a computer-executable program, and when the computer-executable program is called by a computer, the computer implements the The method for resource control access provided by the embodiments of the present application.

Based on the same technical concept, an embodiment of the present application also provides a chip system, the chip system includes: a communication interface for inputting and/or outputting information; a memory for storing computer executable programs; a processor for Executing the computer-executable program enables the device installed with the chip system to implement the resource control access method provided by the embodiment of the present application.

Embodiments of the present application further provide a computer program product, where the computer program product includes computer program instructions that, when the computer program instructions are run on a computer, cause the computer or processor to execute one or more of the foregoing methods. These steps enable the resource control access method provided by the embodiments of the present application to be realized.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted over a computer-readable storage medium. The computer instructions can be sent from one website site, computer, server or data center to another website site, computer, server or data center for transmission. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented. The process can be completed by instructing the relevant hardware by a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed , which may include the processes of the foregoing method embodiments. The aforementioned storage medium includes: ROM or random storage memory RAM, magnetic disk or optical disk and other mediums that can store program codes.

The above are only specific implementations of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the embodiments of the present application shall be covered by this within the protection scope of the application examples. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims (10)

1. A method of resource access control, the method comprising:

receiving an access request sent by a user terminal, wherein the access request is used for requesting to access a data resource and comprises a user Identification (ID) corresponding to an access user;

performing rule language conversion on the access request to obtain the access request converted into a target rule language, wherein the target rule language is different from an original rule language corresponding to the access request, and the target rule language is consistent with a language rule corresponding to the data resource;

inquiring whether historical access information corresponding to the user ID exists from a rule database according to the user ID, and acquiring an inquiry result, wherein the historical access information is the target rule language;

when the query result indicates that the historical access information corresponding to the user ID does not exist in the rule database, allocating a first access right to the access user according to the user ID; when the query result indicates that the rule database has historical access data corresponding to the user ID, acquiring a second access right of the access user from the rule database according to the user ID, wherein the first access right is a right corresponding to the first access of the user, and the second access right is a right corresponding to the non-first access of the user;

acquiring a behavior field according to the access request, and inputting the behavior field, the first access right or the second access right and the illegal access times into a rule server, wherein the behavior field is used for indicating the access behavior of an access user, and the behavior field, the access right and the illegal access times are all target rule languages;

and obtaining an access analysis result output by the rule server, wherein the access analysis result is used for indicating whether the access user is allowed to access data or not.

2. The method of claim 1, wherein the historical access data comprises at least one of:

the first access right or the second access right corresponding to the user ID, and the illegal access times and the legal access times in the historical access corresponding to the user ID.

3. The method according to claim 1 or 2, characterized in that the method further comprises:

when the user is determined to access the data resource for the first time, obtaining user information corresponding to the user according to the access request, wherein the user information comprises the user ID and a first authority distributed for accessing the user;

and storing the acquired user information to a rule database.

4. The method according to claim 1 or 2, wherein the performing rule language conversion on the access request to obtain an access request in a target rule language specifically includes:

and converting the access request from the original rule language into the target rule language through an RE file in a rule server, wherein the original rule language is a corresponding rule language when the access request is input.

5. The method of claim 4, wherein prior to performing a regular language translation on the access request, the method further comprises:

and generating the RE file, wherein the RE file is used for indicating the rule converted into the target rule language.

6. The method according to claim 5, wherein the generating an RE file specifically includes:

performing first analysis processing on a first language, wherein the first analysis processing comprises removing comments and/or lexical analysis, and the first language is a user-defined language;

converting the processed first language into an intermediate language by using the target rule language, wherein the intermediate language is obtained by converting the target rule language into the first language;

compiling the intermediate language into corresponding codes;

and generating the RE file according to the code.

7. An apparatus for resource access control, comprising:

the system comprises a receiving module, a processing module and a processing module, wherein the receiving module is used for receiving an access request sent by a user terminal, the access request is used for requesting to access a data resource, and the access request comprises a user identification ID corresponding to an access user;

the conversion module is used for carrying out regular language conversion on the access request to obtain an access request of a target regular language, wherein the target regular language is different from an original regular language corresponding to the access request, and the target regular language is consistent with a language rule corresponding to the data resource;

the processing module is used for inquiring whether historical access information corresponding to the user ID exists from a rule database according to the user ID and acquiring an inquiry result, wherein the historical access information is the target rule language, and the target rule language is different from an original language corresponding to the access request; when the query result indicates that the historical access information corresponding to the user ID does not exist in the rule database, allocating a first access right to the access user according to the user ID; when the query result indicates that the rule database has historical access data corresponding to the user ID, acquiring a second access right of the access user from the rule database according to the user ID; acquiring a behavior field according to the access request, and inputting the behavior field, the access authority and the illegal access times into a rule server, wherein the behavior field is used for indicating the access behavior of an access user, and the behavior field, the access authority and the illegal access times are all target rule languages; and obtaining an access analysis result output by the rule server, wherein the access analysis result is used for indicating whether the access user is allowed to access data or not.

8. An apparatus for resource access control, comprising:

one or more processors;

one or more memories;

the one or more memories include computer program instructions that, when executed in the processor, cause the apparatus to implement the method of any of claims 1-6.

9. A computer-readable storage medium, characterized in that it stores a computer-executable program which, when invoked by a computer, causes the computer to implement the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that it comprises computer program instructions which, when run on a computer, cause the computer or a processor to implement the method according to any one of claims 1 to 6.

Images